Improve secret handling (#23)

Use AWS secret manager to store secrets. The best way to set this up is
by attaching the right role to the AWS instance.

Author: pcmoritz

app/serve.py

@@ -19,13 +19,29 @@
     SLACK_BOT_TOKEN,
 )
 
+
+def get_secret(secret_name):
+    aws_secret_id = os.environ.get("RAY_ASSISTANT_AWS_SECRET_ID")
+    if aws_secret_id:
+        import boto3
+        client = boto3.client(
+            "secretsmanager", region_name=os.environ["RAY_ASSISTANT_AWS_REGION"]
+        )
+        response = client.get_secret_value(SecretId=aws_secret_id)
+        return json.loads(response["SecretString"])[secret_name]
+    else:
+        raise NotImplemented(
+            "Currently only AWS is supported "
+            "and you need to set RAY_ASSISTANT_AWS_SECRET_ID")
+
+
 app = FastAPI()
 
 
 @ray.remote
 class SlackApp:
     def __init__(self):
-        slack_app = App(token=os.environ["SLACK_BOT_TOKEN"])
+        slack_app = App(token=get_secret("SLACK_BOT_TOKEN"))
 
         @slack_app.event("app_mention")
         def event_mention(body, say):
@@ -39,16 +55,14 @@ def event_mention(body, say):
         self.slack_app = slack_app
 
     def run(self):
-        SocketModeHandler(self.slack_app, SLACK_APP_TOKEN).start()
+        SocketModeHandler(self.slack_app, get_secret("SLACK_APP_TOKEN")).start()
 
 
 ray.init(
     runtime_env={
         "env_vars": {
-            "DB_CONNECTION_STRING": DB_CONNECTION_STRING,
+            "DB_CONNECTION_STRING": get_secret("DB_CONNECTION_STRING"),
             "OPENAI_API_KEY": OPENAI_API_KEY,
-            "SLACK_APP_TOKEN": SLACK_APP_TOKEN,
-            "SLACK_BOT_TOKEN": SLACK_BOT_TOKEN,
         }
     },
     ignore_reinit_error=True,

app/service.yaml

@@ -1,6 +1,10 @@
 name: "ray-assistant"
-cluster_env: ray-assistant
+cluster_env: ray-assistant:2
 ray_serve_config:
   import_path: app.serve:deployment
   runtime_env:
-    working_dir: "https://github.com/ray-project/llm-applications/archive/refs/tags/v0.0.1.zip"
+    working_dir: "https://github.com/ray-project/llm-applications/archive/refs/tags/v0.0.2.zip"
+    env_vars: {
+      RAY_ASSISTANT_AWS_SECRET_ID: "ray-assistant",
+      RAY_ASSISTANT_AWS_REGION: "us-west-2"
+    }